A network traffic early warning method, electronic equipment and storage medium

Abstract

The application provides a network traffic early warning method, an electronic device and a storage medium, and relates to the technical field of computer networks.The method comprises the following steps: analyzing cross-border inbound traffic, obtaining text information of the cross-border inbound traffic and an initial keyword list corresponding to the text information, inputting the initial keyword list into a first neural network model, obtaining a first probability value list, obtaining an intermediate keyword pair list and inputting the intermediate keyword pair list into a second neural network model, obtaining a second probability value list, determining a target intent based on the first probability value list and the second probability value list, and early warning the cross-border inbound traffic based on the target intent, thereby improving the accuracy of early warning of the cross-border inbound traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, in particular to a network traffic early warning method, electronic equipment and storage medium. BACKGROUND

[0002] With the acceleration of globalization, the scale and complexity of cross-border network traffic have significantly increased, however, such traffic also faces serious security challenges, for example, overseas traffic may maliciously obtain user privacy information. The traditional network security protection system mainly relies on rule engine-based traffic filtering, but faces significant challenges in dealing with cross-border scenarios. When using rules to match fields, threats with high concealment may not be detected. On the other hand, although the deep learning-based traffic analysis scheme in the traditional network security protection system can extract text features, it cannot capture the meaning of continuous word combinations, resulting in low accuracy of early warning of malicious cross-border network traffic. SUMMARY

[0003] To solve the above technical problems, the technical scheme adopted by the present application is as follows:

[0004] According to a first aspect of the present application, a network traffic early warning method is provided, which is used for monitoring and early warning of cross-border inbound traffic, comprising the following steps:

[0005] S100, analyzing the cross-border inbound traffic to obtain text information of the cross-border inbound traffic and an initial keyword list corresponding to the text information, the initial keyword list comprising a plurality of initial keywords;

[0006] S200, inputting the initial keyword list into a first neural network model to obtain a first probability value list, the first probability value list comprising corresponding first probability values of the initial keyword list belonging to a plurality of preset intents respectively;

[0007] S300, obtaining an intermediate keyword pair list based on the initial keywords and inputting the intermediate keyword pair list into a second neural network model to obtain a second probability value list, the second probability value list comprising corresponding second probability values of the intermediate keyword pair list belonging to a plurality of preset intents respectively, the intermediate keyword pair list comprising a plurality of intermediate keyword pairs;

[0008] S400, obtaining a preset intent with a weighted sum value of the first probability value and the second probability value greater than a preset probability threshold as a target intent, and early warning the cross-border inbound traffic based on the target intent;

[0009] The intermediate keyword pair is obtained based on the initial keyword by the following steps:

[0010] S310, obtaining a value i, i is initialized as 1, and an intermediate keyword pair is initialized as an initial keyword pair; the initial keyword pair is two initial keywords meeting a preset association requirement and being adjacent in the text information; the preset association requirement is that the distance between the two initial keywords in the text information is less than a preset distance threshold, and the entities corresponding to the two initial keywords exist an association relationship;

[0011] S320, if the i initial keywords all exist in two intermediate keyword pairs, merging the two intermediate keyword pairs in which the i initial keywords all exist to obtain a keyword pair, taking the keyword pair as an intermediate keyword pair, and performing S330; otherwise, ending the loop.

[0012] S330, i = i + 1, and performing S320.

[0013] According to a second aspect of the present application, a non-transitory computer readable storage medium is provided, the storage medium storing a computer program, the computer program being loaded and executed by a processor to implement the method described above.

[0014] According to a third aspect of the present application, an electronic device is provided, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the processor implementing the method described above when executing the computer program.

[0015] The present application has at least the following beneficial effects: in summary, the inbound cross-border traffic is parsed to obtain text information of the inbound cross-border traffic and an initial keyword list corresponding to the text information, the initial keyword list is input into a first neural network model to obtain a first probability value list, an intermediate keyword pair list is obtained and input into a second neural network model to obtain a second probability value list, a target intent is determined based on the first probability value list and the second probability value list, and the inbound cross-border traffic is warned based on the target intent, the present application determines the intent of the text information based on keywords and the relationship between the keywords, and improves the accuracy of the inbound cross-border traffic warning. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 A flowchart of a network traffic warning method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar tasks and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0020] This invention provides a network traffic early warning method, such as... Figure 1 As shown, the method is used to monitor and issue early warnings for cross-border inbound traffic, and includes the following steps:

[0021] S100, parse the cross-border inbound traffic, obtain the text information of the cross-border inbound traffic and the initial keyword list corresponding to the text information, wherein the initial keyword list includes several initial keywords.

[0022] Specifically, cross-border inbound traffic refers to data transmitted from overseas (other countries / regions) to domestic devices or servers. Examples include overseas companies synchronizing data with domestic data centers, and online survey questionnaires or WeChat official account articles sent from overseas to domestic sites.

[0023] In one embodiment of the present invention, parsing cross-border inbound traffic to obtain text information of cross-border inbound traffic includes: capturing cross-border inbound traffic data packets using a packet capture tool, parsing the cross-border inbound traffic data packets according to protocols, and then analyzing the content of the data packets to extract text content; those skilled in the art will know that any method in the prior art for obtaining the initial keywords corresponding to the text information is within the protection scope of the present invention, and will not be described in detail here.

[0024] S200, input the initial keyword list into the first neural network model to obtain the first probability value list, which includes the corresponding first probability values ​​of the initial keyword list belonging to several preset intentions.

[0025] Specifically, the first probability value list B={B1, B2, …, Bj, …, Bn} is obtained, where Bj is a first probability value of the initial keyword list corresponding to the jth preset intent, j ranges from 1 to n, and n is the number of preset intents. Specifically, the first neural network model is a neural network model for judging the probability that the initial keyword belongs to a preset intent.

[0026] In S300, an intermediate keyword pair list is obtained based on the initial keyword, and the intermediate keyword pair list is input into a second neural network model to obtain a second probability value list. The second probability value list includes corresponding second probability values of the intermediate keyword pair list belonging to a plurality of preset intents. The intermediate keyword pair list includes a plurality of intermediate keyword pairs, and the second neural network model is different from the first neural network model.

[0027] Specifically, the second neural network model is a neural network model for judging the probability that the intermediate keyword pair belongs to a preset intent.

[0028] Specifically, the second probability value list C={C1, C2, …, Cj, …, Cn} is obtained, where Cj is a second probability value of the intermediate keyword pair list corresponding to the jth preset intent.

[0029] In S400, a preset intent with a weighted sum value of the first probability value and the second probability value greater than a preset probability threshold is obtained as a target intent, and the cross-border inbound traffic is warned based on the target intent. It can be understood that the preset intent corresponding to the maximum probability value is taken as the target intent through B and C, and the target intent is warned, for example, when the target intent is identified as malicious, a first-level warning is performed, and when the target intent is identified as non-malicious, no warning is performed.

[0030] In S300, the intermediate keyword pair is obtained by the following steps:

[0031] In S310, a value i is obtained, i is initialized as 1, and an intermediate keyword pair is initialized as an initial keyword pair. The initial keyword pair is two initial keywords that meet a preset association requirement and are adjacent in the text information. The preset association requirement is that the distance between the two initial keywords in the text information is less than a preset distance threshold, and the entities corresponding to the two initial keywords have an association relationship.

[0032] In one example of the present application, the initial keyword 1 is Li Bai, the entity corresponding to "Li Bai" is a Chinese Tang Dynasty poet, the initial keyword 2 is Tang Dynasty, the entity corresponding to "Tang Dynasty" is a historical dynasty in China, and "Li Bai" (entity: poet) and "Tang Dynasty" (entity: dynasty) have a correlation relationship: Li Bai lived in the Tang Dynasty; in another example of the present application, the initial keyword 3 is "high blood pressure", the entity corresponding to "high blood pressure" is a disease, and the initial keyword 4 is heart disease, the entity corresponding to "heart disease" is a disease; "high blood pressure" (entity: disease) and "heart disease" (entity: disease) have a correlation relationship: high blood pressure and heart disease are both diseases.

[0033] S320, if i initial keywords exist in both intermediate keyword pairs, merge the two intermediate keyword pairs in which the i initial keywords exist into a keyword pair, and execute S330 as an intermediate keyword pair; otherwise, end the loop.

[0034] Specifically, based on the text information, the entities corresponding to the initial keywords are obtained, and the relationship between the two entities is determined, for example, by querying the knowledge graph to determine the relationship between the two entities. For example, entity extraction is performed on the initial keyword a and the initial keyword b respectively, the knowledge graph is queried, if the relationship exists, it is considered that the entity of a and the entity of b have a relationship, if the relationship does not exist, the text information is analyzed to determine whether the relationship exists by using a relationship extraction model.

[0035] In an embodiment of the present application, the preset distance threshold is equal to the average value of the single sentence length of the text information. It can be understood that if the distance between two initial keywords in the text information is less than the preset distance threshold, it is considered that the distance between the two initial keywords is within the length of a sentence, and therefore the preset distance threshold is set to the average value of the single sentence length of the text information.

[0036] In another embodiment of the present application, the preset distance threshold is equal to the minimum value of the single sentence length of all text information. It can be understood that compared with using the average value, setting the preset distance threshold to the minimum value of all single sentence lengths can determine that the two initial keywords are within the length of a sentence in a larger range.

[0037] S330, i = i + 1, execute S320.

[0038] In summary, a numerical value i is obtained, i is initialized as 1, and an intermediate keyword pair is initialized as an initial keyword pair; if i initial keywords exist in two intermediate keyword pairs, the two intermediate keyword pairs in which the i initial keywords exist are merged to obtain a keyword pair, and the keyword pair is also taken as an intermediate keyword pair; if i+1 initial keywords exist in two intermediate keyword pairs, i is equal to i+1, and the previous step is executed; otherwise, the loop is ended; it can be understood that the intentions represented by initial keyword pairs with different numbers of initial keywords may be different, therefore, all keyword pairs corresponding to initial keyword pairs that meet the condition are obtained in the application, so as to improve the accuracy of intention recognition, thereby improving the accuracy of cross-border inbound traffic early warning.

[0039] In an example of the application, i is initialized as 1, and the initial keyword pairs include: (A1, A2), (A2, A3), and (A3, A4).

[0040] A2 exists in (A1, A2) and (A2, A3), (A1, A2) and (A2, A3) are merged to obtain an intermediate keyword pair (A1, A2, A3), and A3 exists in (A2, A3) and (A3, A4); (A2, A3) and (A3, A4) are merged to obtain an intermediate keyword pair (A2, A3, A4).

[0041] There are 2 initial keywords that exist in two intermediate keyword pairs, that is, A2 and A3 exist in (A1, A2, A3) and (A2, A3, A4); (A1, A2, A3) and (A2, A3, A4) are merged to obtain an intermediate keyword pair (A1, A2, A3, A4).

[0042] There are no 3 initial keywords that exist in two intermediate keyword pairs, and the loop is ended; that is, the intermediate keyword pair list includes: (A1, A2), (A2, A3), (A3, A4), (A1, A2, A3), (A2, A3, A4), and (A1, A2, A3, A4).

[0043] In summary, the cross-border inbound traffic is analyzed to obtain text information of the cross-border inbound traffic and an initial keyword list corresponding to the text information; the initial keyword list is input into a first neural network model to obtain a first probability value list; an intermediate keyword pair list is obtained and input into a second neural network model to obtain a second probability value list; a target intention is determined based on the first probability value list and the second probability value list, and the cross-border inbound traffic is early warned based on the target intention; the application determines the intention of the text information based on keywords and the relationship between the keywords, thereby improving the accuracy of the cross-border inbound traffic early warning.

[0044] Specifically, in S400, the preset intent with a weighted sum value of the first probability value and the second probability value greater than a preset probability threshold is taken as the target intent, and the method further includes the following steps:

[0045] In S410, if the third probability value is greater than the preset probability threshold D0, the preset intent corresponding to the third probability value is marked as an intermediate intent, an intermediate intent list is obtained, the intermediate intent list includes a plurality of intermediate intents, and the third probability value is a weighted sum value of the first probability value and the second probability value.

[0046] In S420, a preset label corresponding to the intermediate intent is obtained, the preset label is a first type label or a second type label, and the first type label is different from the second type label.

[0047] Specifically, the preset label corresponding to the intermediate intent is obtained by setting the preset label corresponding to the preset intent; specifically, the first type label is a malicious label or a non-malicious label, and the second type label is a non-malicious label or a malicious label; preferably, the first type label is a non-malicious label, and the second type label is a malicious label.

[0048] In S430, a third probability value corresponding to all intermediate intents with the first type label is summed as a first type label probability sum value, and a third probability value corresponding to all intermediate intents with the second type label is summed as a second type label probability sum value.

[0049] In S440, if the first type label probability sum value is greater than the second type label probability sum value, the intermediate intent corresponding to the first type label is determined as a candidate intent; otherwise, the intermediate intent corresponding to the second type label is determined as the candidate intent.

[0050] In S450, the target intent is determined based on the candidate intent. In an embodiment of the present application, the candidate intent is taken as the target intent.

[0051] In summary, based on B and C, a third probability value list is obtained, if the jth third probability value is greater than the preset probability threshold D0, the jth preset intent is marked as an intermediate intent, an intermediate intent list is obtained, a preset label corresponding to the intermediate intent is obtained, a third probability value corresponding to the intermediate intent under the first type label is summed as a first type label probability sum value, a third probability value corresponding to the intermediate intent under the second type label is summed as a second type label probability sum value, if the first type label probability sum value is greater than the second type label probability sum value, the intermediate intent corresponding to the first type label is determined as a candidate intent; otherwise, the intermediate intent corresponding to the second type label is determined as the candidate intent, and the target intent is determined based on the candidate intent. The present application determines the target intent again through the first type label and the second type label to avoid the existence of mutually exclusive intents in the target intent.

[0052] Further, S450 further includes:

[0053] S451, analyzing the cross-border inbound traffic to obtain behavior information of the cross-border inbound traffic, the behavior information at least including: occurrence time of the cross-border inbound traffic, request times of the cross-border inbound traffic, user portrait of the cross-border inbound traffic. For example, the user portrait of the cross-border inbound traffic is a female of 20-30 years old.

[0054] In an embodiment of the present application, the user portrait of the cross-border inbound traffic is determined based on the population receiving the cross-border inbound traffic. The population receiving the cross-border inbound traffic can be understood as the population receiving the cross-border inbound traffic.

[0055] S452, obtaining a behavior intention list based on the behavior information of the cross-border inbound traffic, the behavior intention list including a plurality of behavior intentions, and the behavior intention being one of a plurality of preset intentions. Specifically, by inputting the behavior information of the cross-border inbound traffic into a preset neural network model, a probability value corresponding to m preset intentions is obtained, and the preset intention with a probability value greater than a preset traffic threshold is taken as a behavior intention. In an embodiment of the present application, the preset traffic threshold is obtained by the same method as S421-S423.

[0056] S453, taking the intention in the intersection of the alternative intention list and the behavior intention list as the target intention, the alternative intention list including a plurality of alternative intentions.

[0057] In summary, by analyzing the cross-border inbound traffic, obtaining the behavior information of the cross-border inbound traffic, obtaining the behavior intention list corresponding to the behavior information of the cross-border inbound traffic, and taking the intention in the intersection of the alternative intention list and the behavior intention list as the target intention, the present application further determines the target intention through the behavior information of the cross-border inbound traffic, so that the target intention is more accurate.

[0058] Specifically, in another embodiment of the present application, the user portrait of the cross-border inbound traffic is determined by the following steps:

[0059] S4501, analyzing the cross-border inbound traffic to obtain image data contained in the cross-border inbound traffic. For example, image data in the image push of the public number.

[0060] S4502, extracting key features from the image data to obtain key feature values, the key features at least including: preset elements contained in the image data, color distribution of the image data. For example, the key feature value is: a smiling face + red main color.

[0061] S4503, Determine user profiles for cross-border inbound traffic based on key feature values. For example, by pre-constructing a feature-audience association model, key feature values ​​are input into the feature-audience association model to obtain user profiles for cross-border inbound traffic corresponding to the key feature values.

[0062] Furthermore, S410 obtains the preset probability threshold D0 through the following steps:

[0063] S421, Obtain a list of word pair counts, the list of word pair counts includes several word pair counts, wherein when the preset count x equals 1, the word pair count is the number of initial keywords, when the preset count x ranges from 2 to q, the word pair count is the number of intermediate keyword pairs containing x initial keywords, and q is the maximum number of initial keywords contained in the intermediate keyword pairs.

[0064] Specifically, the list of word pairs is E = {E1, E2, ..., Ex, ..., Eq}, where Ex is the number of intermediate keyword pairs containing x initial keywords.

[0065] S422, obtain the weight corresponding to the number of each word pair, where the weight Gx corresponding to the number of each word pair is equal to the normalized first value Wx, the first value is the quotient of 1 divided by the second value, and the second value is equal to the product of q and the number of the word pair, that is, Wx=1 / (q×Ex).

[0066] Specifically, W1, W2...Wx...Wq are normalized to obtain G1, G2...Gx...Gq. Those skilled in the art will know that any method of normalization in the prior art is within the protection scope of this invention, and will not be elaborated here.

[0067] S423, obtain D0, D0 is equal to the sum of the third values ​​corresponding to the number of all word pairs, the third value is equal to the product of the preset initial score of the number of word pairs, the weight corresponding to the number of word pairs, and the number of word pairs.

[0068] In summary, the present invention obtains a list of word pair counts, obtains the weights corresponding to the word pair counts, and obtains D0 based on the weights corresponding to the word pair counts. The present invention determines the weights corresponding to the counts of each word pair by using the word pair counts, and sums the preset initial scores corresponding to the word pair counts to determine the preset probability threshold.

[0069] In another embodiment of the present invention, S422 is replaced with:

[0070] S424, obtain the weight G1 corresponding to E1 and the weight Gx corresponding to Ex, where G1 is the normalized value of W1 and Gx is the normalized value of Wx, and r is a preset ratio. W1 satisfies the following condition: W1 × (1 - r) q) / (1 - r) = 1, Wx satisfies the following condition: Wx = W1 * r x-1 .

[0071] Specifically, the training data of different values of q is obtained, the training data is historical overseas inbound traffic and historical overseas inbound traffic corresponding to the real intention, the first preset probability threshold corresponding to the training data is obtained by using the first threshold value acquisition method of S421-S422-S423, and the prediction is performed based on the first preset probability threshold and the training data using S100-S400, the first loss value between the predicted target intention and the real intention is obtained, thereby obtaining a plurality of first loss values corresponding to the plurality of values of q, taking the value of q as the independent variable and the first loss value as the dependent variable, and constructing the first loss function;

[0072] The second preset probability threshold corresponding to the training data is obtained by using the second threshold value acquisition method of S421-S424-S423, and the prediction is performed based on the second preset probability threshold and the training data using S100-S400, the second loss value between the predicted target intention and the real intention is obtained, thereby obtaining a plurality of second loss values corresponding to the plurality of values of q, taking the value of q as the independent variable and the second loss value as the dependent variable, and constructing the second loss function;

[0073] The intersection of the first loss function and the second loss function is obtained, and the value of the independent variable corresponding to the intersection is taken as q0, when q is greater than q0, the slope of the first loss function at q0 is greater than the slope of the second loss function at q0, the first threshold value acquisition method is taken as the target method for obtaining the preset probability threshold D0, otherwise, the second threshold value acquisition method is taken as the target method for obtaining the preset probability threshold D0.

[0074] Embodiments of the application also provide a non-transitory computer readable storage medium, which can be arranged in an electronic device to save a computer program related to a method in the method embodiment, and the computer program is loaded and executed by the processor to realize the method provided by the above embodiments.

[0075] Embodiments of the application also provide an electronic device, comprising: a processor, a memory, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to realize the method provided by the above embodiments.

[0076] Although some specific embodiments of the application have been described in detail by examples, those skilled in the art should understand that the above examples are only for illustration, not for limiting the scope of the application. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the application.

Claims

1. A network traffic early warning method, characterized in that, The method is used to monitor and issue early warnings for cross-border inbound traffic, and includes the following steps: S100, parse the cross-border inbound traffic, obtain the text information of the cross-border inbound traffic and the initial keyword list corresponding to the text information, wherein the initial keyword list includes several initial keywords; S200, Input the initial keyword list into the first neural network model to obtain the first probability value list, which includes the corresponding first probability values ​​of the initial keyword list belonging to several preset intentions respectively; S300, obtain an intermediate keyword pair list based on the initial keywords, and input the intermediate keyword pair list into the second neural network model to obtain a second probability value list. The second probability value list includes the corresponding second probability values ​​of the intermediate keyword pair list belonging to several preset intentions. The intermediate keyword pair list includes several intermediate keyword pairs. The second neural network model is different from the first neural network model. S400: Obtain a preset intent whose weighted sum of the first probability value and the second probability value is greater than a preset probability threshold as the target intent, and issue an early warning for cross-border inbound traffic based on the target intent; Obtain intermediate keyword pairs based on initial keywords using the following steps: S310, get the value i, initialize i to 1, and initialize the intermediate keyword pair to the initial keyword pair; the initial keyword pair is two initial keywords that meet the preset association requirements and are adjacent in the text information; The preset association requirements are: the distance between two initial keywords in the text information is less than a preset distance threshold, and the entities corresponding to the two initial keywords are related. S320: If all i initial keywords exist in both intermediate keyword pairs, merge the two intermediate keyword pairs that all i initial keywords exist into one intermediate keyword pair, and execute S330; otherwise, end the loop. S330, i=i+1, execute S320.

2. The network traffic early warning method according to claim 1, characterized in that, The preset distance threshold is equal to the average length of a single sentence in the text information.

3. The network traffic early warning method according to claim 1, characterized in that, The preset distance threshold is equal to the minimum sentence length of all text information.

4. The network traffic early warning method according to claim 1, characterized in that, In S400, obtaining a preset intent where the weighted sum of the first probability value and the second probability value is greater than a preset probability threshold is taken as the target intent, and also includes: S410, if the third probability value is greater than the preset probability threshold D0, mark the preset intent corresponding to the third probability value as an intermediate intent, obtain the intermediate intent list, the intermediate intent list includes several intermediate intents, and the third probability value is the weighted sum of the first probability value and the second probability value. S420, Obtain a preset tag corresponding to the intermediate intent, wherein the preset tag is a first type tag or a second type tag, and the first type tag is different from the second type tag; S430, sum the third probability values ​​corresponding to all intermediate intentions with the preset label being the first type label as the first type label probability sum value, and sum the third probability values ​​corresponding to all intermediate intentions with the preset label being the second type label as the second type label probability sum value; S440, if the sum of probabilities of the first type of label is greater than the sum of probabilities of the second type of label, determine the intermediate intent corresponding to the first type of label as the candidate intent; otherwise, determine the intermediate intent corresponding to the second type of label as the candidate intent. S450 determines the target intent based on alternative intents.

5. The network traffic early warning method according to claim 4, characterized in that, The S450 also includes: S451, parse the cross-border inbound traffic to obtain the behavior information of the cross-border inbound traffic. The behavior information includes at least: the occurrence time of the cross-border inbound traffic, the number of requests of the cross-border inbound traffic, and the user profile of the cross-border inbound traffic. S452, Obtain a list of behavioral intentions based on the behavioral information of cross-border inbound traffic, wherein the list of behavioral intentions includes several behavioral intentions, and a behavioral intention is one of several preset intentions; S453, the intentions in the intersection of the alternative intention list and the behavioral intention list are taken as the target intentions, wherein the alternative intention list includes several alternative intentions.

6. The network traffic early warning method according to claim 4, characterized in that, S410 obtains the preset probability threshold D0 through the following steps: S421, Obtain a list of word pair counts, the list of word pair counts includes several word pair counts, wherein when the preset count x equals 1, the word pair count is the number of initial keywords, when the preset count x ranges from 2 to q, the word pair count is the number of intermediate keyword pairs containing x initial keywords, and q is the maximum number of initial keywords contained in the intermediate keyword pairs; S422, obtain the weight corresponding to the number of each word pair, where the weight corresponding to the number of each word pair is equal to the normalized first value, the first value is the quotient of 1 divided by the second value, and the second value is equal to the product of q and the number of the word pair; S423, obtain D0, D0 is equal to the sum of the third values ​​corresponding to the number of all word pairs, the third value is equal to the product of the preset initial score of the number of word pairs, the weight corresponding to the number of word pairs, and the number of word pairs.

7. The network traffic early warning method according to claim 5, characterized in that, Based on the population receiving cross-border inbound traffic, we determine the user profile of cross-border inbound traffic.

8. The network traffic early warning method according to claim 5, characterized in that, The following steps are used to determine the user profile of cross-border inbound traffic: S4501 analyzes cross-border inbound traffic to obtain image data contained in the cross-border inbound traffic; S4502, extract key features from image data and obtain key feature values. The key features include at least: preset elements contained in the image data and color distribution of the image data. S4503, determines user profiles for cross-border inbound traffic based on key feature values.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the network traffic early warning method as described in any one of claims 1-8.

10. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the network traffic early warning method as described in any one of claims 1-8.

Images